[squid-users] Logging username with upstream authenticated proxy

From: Kiran Maraju <kiran@dont-contact.us>
Date: Fri, 20 Aug 2004 13:20:20 +0530

---------------------------------------------------------------

  Client ----> squid Box ----> proxy ( apache ) -----> real server
                              user authentication
---------------------------------------------------------------

This is my configuration. whatever client requests squid forwards to upsteam
proxy , there user authentication is at proxy(apache) . In squid logs i could
only able to see the "-" in the user name filed. User name is coming in
apache.log.(proxy log ).

Q1) Is there any way to get Username in squid access log. how to achieve this,
if not whaere the coding modifications should take place..?

Q2) i tried to use log_mime_hdrs on. there i could get encoded string of user
authentication. i am using basic authentication. how to decode the string.. is
there any way to get usernames at the squid itself? R there any tools available
to achive username at the squil level..?

Thanks & Regards

kiran
 
-------------------------------------------------------------------------------

Quoting Henrik Nordstrom <hno@squid-cache.org>:

> On Tue, 17 Aug 2004, Hutton, Benjamin wrote:
>
> > I currently have Squid & Dansguardian setup. Squid is setup as a
> downstream to our governing organizations proxy which requires
> authentication.
>
> In such case the username is never really known to Squid, just passed
> along to the parent..
>
> but is should be possible with the help of the custom logformats patch to
> extend Squid to log the forwarded username. At a minimum (no changes
> required) it can log the Proxy-Authorization header as-is allowing
> logprocessing software to decode the login name from there but with some
> small amount of programming Squid can be extended to automatically extract
> the login for use in the log file.
>
> To extract it for use in redirectors is a little harder as the user has
> not authenticated to your Squid, only to the parent. But it is not
> technically impossible to implement.
>
> Regards
> Henrik
Received on Fri Aug 20 2004 - 01:43:03 MDT

This archive was generated by hypermail pre-2.1.9 : Wed Sep 01 2004 - 12:00:02 MDT